CliInvoke.Specializations, a .NET library providing wrappers for invoking command-line shells like PowerShell and Windows Command Prompt, contains an OS command injection vulnerability (CWE-78) in versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, 3.0.0-alpha.8 through 3.0.0-alpha.10, and AlastairLundy.CliInvoke.Specializations versions 1.0.0-rc.1 through 1.6.1.1. The vulnerability arises because the wrappers pass a caller-controlled target and arguments to the shell commands using a single ProcessStartInfo.Arguments string, allowing a double quote in untrusted input to break quoting and cause execution of additional commands with the host process's privileges. The issue is patched in versions 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.1, and 2.0.2 respectively. No complete workaround exists; partial mitigations include rejecting or removing double quotes and shell metacharacters or bypassing the vulnerable wrappers.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the host process running the vulnerable CliInvoke.Specializations wrappers. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.4 (high).

Official patches are available in CliInvoke.Specializations versions 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.1, and AlastairLundy.CliInvoke.Specializations version 2.0.2. Users should upgrade to these versions to fully remediate the vulnerability. No complete workaround exists; users unable to upgrade should sanitize inputs by rejecting or removing double quotes from target paths and arguments, additionally reject shell metacharacters in affected versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input.